Exploiting CVE-2021-41073 in io_uring

Valentina Palmiotti published an excellent write-up about exploiting a type confusion in io_uring to gain root privileges.

This bug allows freeing arbitrary slab allocations from the kmalloc-32 cache.

Valentina described how she constructed these exploit primitives:

✔️ UAF in kmalloc-32
✔️ Kernel heap info-leak
✔️ Control flow hijacking
✔️ Illegal privilege escalation

The researcher also described her experience with responsible disclosure.

Compilers: The Old New Security Frontier

Brad Spengler published the slides from his talk at BlueHat IL 2022.

He gave an overview of open problems in operating system security and described how compiler plugins could help.

The Discovery and Exploitation of CVE-2022-25636

Nick Gregory published an article about exploiting a heap out-of-bounds write in netfilter. The researcher managed to hijack the kernel control flow.

Racing against the clock — hitting a tiny kernel race window

An article by Jann Horn on using hardware timers to widen race condition windows.

Jann applied his method to a race condition in the garbage collector for unix sockets, which had a race window of only 12 instructions.

The article also contains Jann's investigations on the precision of hardware timers in Intel CPUs.

CVE-2022-27666: Exploit esp6 module in Linux kernel

Xiaochen Zou aka ETenal published an article on exploiting a page_alloc-out-of-bounds in the esp6 crypto module.

The researcher:

1️⃣ performed page-level heap fengshui to gain page_alloc-to-slab overflow,

2️⃣ constructed arbitrary read/write using the msg_msg kernel object,

3️⃣ finally achieved root privileges via modprobe_path overwrite.

The article comes with excellent animated diagrams.

How The Tables Have Turned: An analysis of two new Linux vulnerabilities in nf_tables

A detailed article by David Bouman about exploiting an integer-overflow leading to a limited stack-out-of-bounds read/write in the nf_tables module.

The exploit constructs a filter whose logic depends on the value of a kernel address that happens to be on the stack. This way, it leaks the KASLR offset by observing the side-effects.

The exploit then builds a ROP chain that leaves the softirq context where the bug is triggered, switches to the root network namespace, and gains root privileges.

Writing a Linux Kernel Remote [Exploit] in 2022

An article by Samuel Page @sam4k1 about writing an exploit for a remotely-triggerable stack-buffer-overflow in TIPC (CVE-2022-0435).

Assuming the absence of KASLR and the Stack Protector, the exploit overwrites the stack with a ROP chain that hooks a syscall to hijack a root process.

Looking for Remote Code Execution bugs in the Linux kernel

I wrote an article about fuzzing the Linux kernel network stack externally with syzkaller.

The article covers:

🧰 Introduction to syzkaller
💉 Using TUN/TAP for injecting packets into the kernel
🚚 Patching TUN/TAP for collecting coverage via KCOV
👽 Adding pseudo-syscalls for network fuzzing
🗄 Describing packet structure in syzlang
🏆 Showcases of found bugs

In the article, I put a focus on the presentation: highlighted syzlang code, made interactive snippets, added side notes that are actually on the side. I also implemented a dynamic table of contents (only visible on large screens).

The described work was done a few years ago, but I consider it still relevant. The recent trend of looking for remote Linux kernel exploits is quite exciting! I hope to see even more research in this area.

Learning Linux kernel exploitation — Part 2 — CVE-2022-0847

A detailed article by 0xricksanchez about the Dirty Pipe vulnerability and its exploitation. The article also recaps Dirty Cow and compares it to Dirty Pipe.

Exploiting Dirty Pipe on Android

Two publications about exploiting Dirty Pipe on Android. Both use similar techniques without additional vulnerabilities.

1. Notes and an exploit by polygraphene.

2. Slides by Giovanni Rocca.

Tetragone: A Lesson in Security Fundamentals

An article by Pawel Wieczorkiewicz and Brad Spengler about bypassing post-exploitation detection provided by Tetragon.

The article also expands on the impossibility of preventing malicious post-exploitation activity if the prevention component works at the same privilege level as the attacked code.

Similar concerns affect LKRG. Check out the LKRG bypass article by Alexander Popov for the details.

A Kernel Hacker Meets Fuchsia OS

Alexander Popov (me) published an article about hacking the Zircon microkernel of Fuchsia OS.

Experience in Linux kernel security helped to assess Fuchsia OS from the attacker's point of view.

Summary:
🟪 Fuchsia security architecture
🟪 Exploit development experiments for the Zircon microkernel
🟪 PoC attack planting a rootkit into the microkernel

kconfig-hardened-check: new feature

kconfig-hardened-check is a tool for checking the security hardening options of the Linux kernel.

Initially, it supported checking compile-time Kconfig options that are relevant for security.

And now this tool can also check the kernel cmdline options, aka boot parameters.

Fuzzing USB with Raw Gadget

Slides and video from a talk by Andrey Konovalov on fuzzing USB drivers.

The talk covers:

🤖 Raw Gadget — a new interface for emulating USB devices
🪶 Fuzzing in a VM via virtual USB controllers
🔌 Reproducing found bugs via Raspberry Pi Zero

Linux kernel heap feng shui in 2022

An article by Michael S and Vitaly Nikolenko describing the kernel changes that affected exploitation techniques for slab-related vulnerabilities over the last few years.

Two eBPF exploits

Exploits for two bugs in the eBPF code, CVE-2021-4204 and CVE-2022-23222, by tr3e with brief write-ups in Chinese.

Exploration of the Dirty Pipe Vulnerability (CVE-2022-0847)

An article by Valentin Obst and Martin Claus covering the Dirty Pipe vulnerability. The article also suggests a few approaches to investigating Linux kernel bugs.

Yet another bug into Netfilter

An article by Arthur Mongodin about exploiting an out-of-bounds access in the netfilter subsystem to achieve an info-leak. The article also suggests a potential approach to gain privilege escalation.

io_uring - new code, new bugs, and a new exploit technique

Lam Jun Rong published an article that covers analyzing and exploiting CVE-2021-41073, an invalid-free vulnerability in the io_uring subsystem.

This vulnerability has previously been exploited by Valentina Palmiotti, but that exploit relied on eBPF. The new exploit targets Ubuntu 21.10, where eBPF is not available to unprivileged users.

The Android kernel mitigations obstacle race

A great article by Man Yue Mo about exploiting a race condition that leads to a use-after-free vulnerability in the Qualcomm GPU driver for Samsung Galaxy Z Flip3.

The researcher widened the race window to hit the bug reliably, and then bypassed kCFI, automatic variable initialization, and Samsung RKP in the exploit.

TripleCross

A Linux eBPF rootkit providing a backdoor with command and control (C2) capabilities, library injection, execution hijacking, persistence, and hiding.